Loading story…
Former U.S. Army soldier Cameron John Wagenius, known online as kiberphant0m, was sentenced to 70 months in federal prison and ordered to pay $294,978 in restitution for hacking, data theft and extortion targeting telecommunications companies and other organizations. Prosecutors said Wagenius and co-conspirators obtained credentials for at least 10 victims between April 2023 and December 2024, stole and sold sensitive data, demanded ransoms, and used records in SIM-swapping fraud. He pleaded guilty to wire-fraud conspiracy, computer-fraud-related extortion, aggravated identity theft, and unlawful transfers of confidential phone records.
While stationed at Fort Cavazos, Wagenius used the credential-stealing tool SSH Brute, which he helped develop, and collaborated with Connor Moucka and alleged co-conspirator John Erin Binns. The operation was tied to the Snowflake customer-data theft wave, in which stolen credentials and accounts lacking multifactor authentication enabled theft of billions of records, including call and text metadata affecting more than 100 million AT&T customers. AT&T paid a $370,000 Bitcoin ransom; the group later posted purported call logs for Donald Trump and Kamala Harris and alleged NSA schematics. Wagenius also allegedly tried to sell stolen data to a foreign intelligence service and, while awaiting sentencing, sought exploit and escape-related guidance through other inmates' email accounts; authorities said they found no evidence he compromised Bureau of Prisons systems.
See the reporting duties and controls this puts on the clock.
12 events from the most recent confirmed update back to the earliest known activity.
While awaiting sentencing, Wagenius allegedly used other inmates' email accounts to seek AI-generated Windows privilege-escalation guidance, exploit code for CVE-2023-45208, prison antenna advice, and prison-escape research. The government said it found no evidence he used or deployed vulnerabilities against Bureau of Prisons systems.
Moucka pleaded guilty to a central role in compromising more than 165 Snowflake customer environments and enabling large-scale theft used for extortion.
Wagenius pleaded guilty to wire-fraud conspiracy, computer-fraud-related extortion, aggravated identity theft, and related hacking and data-theft offenses.
Canadian national Connor Moucka was extradited to the United States in connection with the Snowflake customer-environment compromises.
Federal authorities arrested Wagenius, finding thousands of stolen identification documents and substantial cryptocurrency holdings on seized devices. Following the seizure, he acquired a new laptop despite an order from his commanding officer not to do so and used it in barracks at Fort Cavazos.
Wagenius published two posts disclosing confidential call records belonging to a government official and relatives of a former official, while threatening to release further records unless ransoms were paid. Accounts attributed to him also posted purported call logs associated with Donald Trump and Kamala Harris.
An account using Wagenius's Kiberphant0m alias claimed it had stolen call and text metadata for tens of millions of AT&T customers, including phone numbers, timestamps, and call durations.
AT&T disclosed that attackers had stolen call and text records for nearly all of its cellular customers over a six-month period in 2022 from its Snowflake account.
Conor Riley Moucka, also known as Judische, was arrested in connection with the Snowflake customer data thefts.
Between April 2023 and December 2024, Cameron John Wagenius and associates obtained credentials for at least 10 organizations. They used SSH Brute and stolen credentials to access cloud environments, steal data, demand ransoms, sell data, and conduct SIM-swapping-related fraud.
Attackers stole six months of call and text records involving nearly all AT&T cellular customers from AT&T's Snowflake account during 2022.
A federal court sentenced former Army soldier Cameron John Wagenius to 70 months in prison for the cyberattack and extortion campaign and ordered him to pay approximately $294,978 in restitution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcekrebsonsecurity.com
Open sourcecyberscoop.com
Open sourcenextgov.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Connor Riley Moucka, a 26-year-old Canadian national, pleaded guilty in U.S. federal court for his role in a Snowflake-linked hacking and extortion campaign that compromised at least 165 organizations and exposed data tied to at least 100 million people. Prosecutors said the group used stolen credentials between February and October 2024 to access cloud-hosted customer environments, steal terabytes of sensitive data and billions of files, and extort victims by threatening to publish the information. Reported victims included **AT&T, Ticketmaster, Advance Auto Parts, Neiman Marcus, Santander,** and **LendingTree**, with stolen records including banking data, Social Security numbers, passport numbers, driver’s license numbers, and DEA registration numbers. Investigators said the intrusions were not caused by a compromise of Snowflake itself but by previously exposed customer credentials, many traced to infostealer malware infections dating back to 2020. Mandiant found that at least **79.7%** of the accounts used in the campaign had prior credential exposure, and observed the attackers using Snowflake’s **SnowSight** web interface, the **SnowSQL** CLI, **DBeaver Ultimate**, and a reconnaissance utility tracked as **FROSTBITE** to enumerate users, roles, IPs, session IDs, and organization names. Authorities said the conspiracy generated more than **$2.5 million** in ransom payments, while Moucka separately made about **$495,000** selling stolen data on cybercrime forums; he was extradited to the United States and is scheduled to be sentenced on October 27, 2026.
Aug 8, 2026
Former AT&T retail employee Kenneth Carter of Portland, Oregon, received a 16-month federal prison sentence for using authorized store-system access to conduct SIM swaps for cybercriminals between May 2018 and November 2019. Carter transferred victims' phone numbers to SIM cards controlled by himself or co-conspirators, allowing them to reset account passwords and intercept SMS-based multifactor authentication codes tied to online banking accounts. The conspiracy attempted to steal **$593,963.77** from three victims. Fraud controls stopped two attempted bank transfers of roughly $247,000 each, but a third victim lost **$99,528.33**; a 2019 search of Carter's home also recovered victims' sensitive data, including Social Security numbers. The case illustrates the risk of insider-enabled SIM swapping and reliance on SMS-based authentication for high-value financial accounts.
Sep 15, 2026
Cameron Curry, a former data analyst contractor from Charlotte, North Carolina, was sentenced to 24 months in federal prison for a cyber extortion campaign against a Washington, D.C.-based international technology company identified in reporting as Brightly Software. Prosecutors said Curry abused legitimate insider access to steal sensitive corporate records and employee information after learning his contract would not be renewed, then used the alias **"Loot"** to send more than 60 extortion emails between December 2023 and January 2024 demanding **$2.5 million in cryptocurrency**. The messages threatened to leak company and employee data, report the company to the SEC for failing to disclose a breach, and expose alleged pay disparities if payment was not made. A federal jury convicted Curry in March 2026 on six interstate extortion-related communications counts, and investigators tied him to the scheme through email metadata, account records, an Outlook address, and a Coinbase account linked to debit cards belonging to his mother and sister; an FBI search of his residence on January 24, 2024, led to the seizure of computer equipment and forensic evidence confirming he operated the **"Loot"** persona.
Aug 19, 2026